Stay Secure with the Latest Linux Advisories

security advisoryencryption issueMageia

Mageia: 2020-0308 Moderate: Botan2 CBC Length Leak Issue

The CBC padding operations were not constant time and as a result would leak the length of the plaintext values which were being padded to an attacker running a side channel attack via shared resources such as cache or branch predictor. No information about the contents was leaked, but the length alone might be used to make inferences about the contents. This issue affects TLS CBC . MGASA-2020-0308 - Updated botan2 packages fix security vulnerability Publication date: 31 Jul 2020 URL: https://advisories.mageia.org/MGASA-2020-0308.html Type: security Affected Mageia releases: 7 The CBC padding operations were not constant time and as a result would leak the length of the plaintext values which were being padded to an attacker running a side channel attack via shared resources such as cache or branch predictor. No information about the contents was leaked, but the length alone might be used to make inferences about the contents. This issue affects TLS CBC ciphersuites as well as CBC encryption using PKCS7 or other similar padding mechanisms. In all cases, the unpadding operations were already constant time and are not affected (rhbz#1849743). References: - https://bugs.mageia.org/show_bug.cgi?id=26955 - https://bugzilla.redhat.com/show_bug.cgi?id=1849743 - https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./thread/Q5LBXWVOCUQCEGOOMVMLI4WVTQ5DT4RG/ SRPMS: - 7/core/botan2-2.9.0-2.1.mga7 . Recent botan2 updates address a vulnerability that caused length leakage linked to CBC padding processes in Mageia.. Botan2 Security, Mageia Advisory, CBC Padding Issue, Side Channel Attack. . LinuxSecurity.com Team

Jul 31, 2020 Mageia